@monster-orange/den 0.4.1 → 0.4.3

package/src/ui/cli/sessions-command.ts

@@ -13,17 +13,21 @@
  *
  * The R8 lock is the web UI's (an in-memory admin password in the web
  * server); CLI service actions (up, down) do not consult it, so neither do
- * these. agents.max_concurrent caps every start.
+ * these. sessions.max_concurrent caps the plain sessions running at once;
+ * agents count against agents.max_concurrent instead, never this one.
  */
 import { spawn } from "child_process";
 import * as fs from "fs";
 import * as path from "path";
-import { readAgentsConfig } from "../../shared/den-config.js";
+import {
+  readAgentsConfig,
+  readSessionsConfig,
+} from "../../shared/den-config.js";
 import { cliEntrypoint } from "../../shared/engine.js";
 import { getDistRoot, getInvokeCwd, getStateDir } from "../../shared/paths.js";
 import { product } from "../../shared/product.js";
 import { ENV_NAME_RE, isCredentialShaped } from "../../shared/secret-env.js";
-import { allScrubEnv } from "../../shared/agents/runtimes.js";
+import { allScrubEnv, withSessionPath } from "../../shared/agents/runtimes.js";
 import {
   ensureHost,
   connectHost,
@@ -64,7 +68,7 @@ export const SESSIONS_HELP = {
     "session host (one per distribution, started on demand).",
     "",
     "{cli} sessions start --workspace <ws> --name <n> [--cwd <dir>] [--keep-env NAME…] -- <argv…>",
-    "    run argv in a PTY as <dist>-<ws>:<n> (cwd: here); capped by agents.max_concurrent",
+    "    run argv in a PTY as <dist>-<ws>:<n> (cwd: here); capped by sessions.max_concurrent",
     "    env: PATH, HOME, USER, LOGNAME, SHELL, TERM, COLORTERM, LANG, LC_*, TZ,",
     "    TMPDIR only; --keep-env NAME (exact, repeatable; audited) adds one",
     "    (never a person's credential: DEN_PERSON_TOKEN, a web.secret path)",
@@ -97,7 +101,10 @@ export interface SessionsDeps {
   connectExisting?: () => Promise<HostClient | null>;
   pty?: () => PtyLoad;
   workspaceExists?: (ws: string) => boolean;
+  /** agents.max_concurrent: the agents running at once. */
   maxConcurrent?: () => number;
+  /** sessions.max_concurrent: the plain sessions running at once. */
+  maxSessions?: () => number;
   invokeCwd?: () => string;
   env?: NodeJS.ProcessEnv;
   out?: (line: string) => void;
@@ -114,7 +121,10 @@ export interface Resolved {
   connectExisting: () => Promise<HostClient | null>;
   pty: () => PtyLoad;
   workspaceExists: (ws: string) => boolean;
+  /** agents.max_concurrent: the agents running at once. */
   maxConcurrent: () => number;
+  /** sessions.max_concurrent: the plain sessions running at once. */
+  maxSessions: () => number;
   invokeCwd: () => string;
   env: NodeJS.ProcessEnv;
   out: (line: string) => void;
@@ -180,6 +190,7 @@ export function resolveDeps(d: SessionsDeps): Resolved {
     pty: d.pty ?? (() => loadPty()),
     workspaceExists: d.workspaceExists ?? defaultWorkspaceExists,
     maxConcurrent: d.maxConcurrent ?? (() => readAgentsConfig().maxConcurrent),
+    maxSessions: d.maxSessions ?? (() => readSessionsConfig().maxConcurrent),
     invokeCwd: d.invokeCwd ?? getInvokeCwd,
     env: d.env ?? process.env,
     out: d.out ?? ((l) => console.log(l)),
@@ -309,14 +320,19 @@ export function contractInfo(s: SessionInfo): SessionInfo {
 // ── subcommands ───────────────────────────────────────────────────────────────
 
 /**
- * A plain session's env (AG spec §5a-env): the allowlist, the names the
- * user kept, then every runtime's scrubEnv. `doctor --probe` checks it.
+ * A plain session's env (AG spec §5a-env): the allowlist (its PATH with
+ * the runtime search's directories, AG-0.1), the names the user kept, then
+ * every runtime's scrubEnv. `doctor --probe` checks it.
  */
 export function plainSessionEnv(
   caller: NodeJS.ProcessEnv,
   keep: readonly string[] = [],
 ): Record<string, string> {
-  return buildSessionEnv({ caller, keep, scrub: allScrubEnv() });
+  return buildSessionEnv({
+    caller: withSessionPath(caller),
+    keep,
+    scrub: allScrubEnv(),
+  });
 }
 
 /** Who ran the CLI, for an audit line: a login name, printable. */
@@ -437,7 +453,7 @@ async function start(args: string[], d: Resolved): Promise<number> {
     d.err(`  \`${d.cli} doctor\` shows the session backend's state.`);
     return 1;
   }
-  const limit = d.maxConcurrent();
+  const limit = d.maxSessions();
   const full = sessionName(d.dist, ws, name);
   const tty = d.stdout.isTTY;
   return withClient(d, async (c) => {
@@ -453,6 +469,7 @@ async function start(args: string[], d: Resolved): Promise<number> {
         },
         {
           limit,
+          pool: "sessions",
           // Audited by the host: each name, and whether it is
           // credential-shaped; never a value.
           ...(kept.length
@@ -480,7 +497,7 @@ async function start(args: string[], d: Resolved): Promise<number> {
       d.err(`✗ ${e.message}`);
       if (e.code === "cap")
         d.err(
-          `  Stop one first (\`${d.cli} sessions kill <name>\`), or raise agents.max_concurrent.`,
+          `  Stop one first (\`${d.cli} sessions kill <name>\`), or raise sessions.max_concurrent.`,
         );
       if (e.code === "exists")
         d.err(

package/src/ui/cli/web-command.ts

@@ -21,6 +21,7 @@ import {
   rotateWebSecret,
 } from "../../shared/web-secret.js";
 import {
+  ignoredConfigWarning,
   localhostOrigin,
   loginLink,
   mintLoginCode,
@@ -32,7 +33,8 @@ import {
 } from "../../shared/web-session.js";
 import { revokeAllActorTokens } from "../../shared/actor-token.js";
 import { engineBin, engineModuleFile } from "../../shared/engine.js";
-import { readWebPort } from "../../shared/edge/config.js";
+import { readEdgeConfig, readWebPort } from "../../shared/edge/config.js";
+import { webRouteHosts } from "../../shared/edge/render.js";
 import {
   ownServer,
   processCwd,
@@ -1080,7 +1082,7 @@ export function displayWebHelp(): void {
   console.log(`  ${product().cli} web --setup-browser-access`);
   console.log(`  ${product().cli} web token --print`);
   console.log(
-    `  ${product().cli} web login [--next <path>] [--origin <url>] [--port <port>]`,
+    `  ${product().cli} web login [--next <path>] [--host <name> | --origin <url>] [--port <port>]`,
   );
   console.log(`  ${product().cli} web sessions [--json] [--port <port>]`);
   console.log(
@@ -1242,7 +1244,12 @@ export async function cmdWeb(args: string[]): Promise<void> {
 
   // SEC-1b: a wrong web.allow_plain_http_remote would stop the server at
   // start; say so here, naming the key, instead of "did not become ready".
-  readWebAuthConfig(getDistRoot(), product().configFile);
+  // A key read and ignored (the distribution's web.allow_plain_http_remote:
+  // only user.yml counts) is said here too, not only in the server's log.
+  const ignored = ignoredConfigWarning(
+    readWebAuthConfig(getDistRoot(), product().configFile),
+  );
+  if (ignored) console.log(chalk.yellow(`\n  ⚠ ${ignored}`));
 
   const apiRunning = await isDenWebApiRunning(options.port);
   let running = apiRunning && (await isDenWebUiReady(options.port));
@@ -1386,20 +1393,24 @@ function takePort(args: string[]): { port: number; rest: string[] } {
 }
 
 /**
- * `<cli> web login [--next <path>] [--origin <url>]`: a fresh sign-in link
+ * `<cli> web login [--next <path>] [--host <name> | --origin <url>]`: a fresh sign-in link
  * on stdout, alone (the only place a login code is ever printed); a note on
- * stderr. `--origin` for the edge hostname or a LAN name, where the cookie
- * must be set (the signed-out page there says which).
+ * stderr. `--host` for an edge hostname (its URL from the edge config),
+ * `--origin` for any allowed origin (a LAN name), where the cookie must be
+ * set (the signed-out page there says which).
  */
 export function cmdWebLogin(args: string[], io: CliIo = stdIo): number {
-  const usage = `Usage: ${product().cli} web login [--next <path>] [--origin <url>] [--port <port>]\n`;
+  const usage = `Usage: ${product().cli} web login [--next <path>] [--host <name> | --origin <url>] [--port <port>]\n`;
   if (isHelp(args)) {
     io.out(
       usage +
         "  Prints a one-time sign-in link (it works once, within 60 s) for one browser.\n" +
         "  On localhost nothing asks for a sign-in; it is needed when this server is\n" +
-        "  reached beyond this machine (the edge, or a LAN address: pass its --origin).\n" +
+        "  reached from another machine (pass the edge hostname as --host, or a LAN\n" +
+        "  address as --origin).\n" +
         "  --next <path>   where the browser lands after signing in (same origin only)\n" +
+        "  --host <name>   an edge hostname that routes here (an edge domain or alias,\n" +
+        "                  a VPN name among them): the link uses its edge URL\n" +
         "  --origin <url>  the address the browser uses, http(s)://host[:port]\n",
     );
     return 0;
@@ -1424,8 +1435,16 @@ export function cmdWebLogin(args: string[], io: CliIo = stdIo): number {
           : undefined;
     const n = val("--next");
     const o = val("--origin");
+    const h = val("--host");
     if (n !== undefined) next = n;
-    else if (o !== undefined) {
+    else if (h !== undefined) {
+      const found = edgeOriginFor(h, port);
+      if (typeof found !== "string") {
+        io.err(found.error);
+        return 2;
+      }
+      origin = found;
+    } else if (o !== undefined) {
       origin = parseOrigin(o);
       if (!origin) {
         io.err(
@@ -1451,6 +1470,38 @@ export function cmdWebLogin(args: string[], io: CliIo = stdIo): number {
   return 0;
 }
 
+/**
+ * `web login --host <name>`: the origin a browser uses for an edge hostname
+ * that routes to this server (edge.routes under any edge domain or alias),
+ * or why there is none and what to add.
+ */
+export function edgeOriginFor(
+  name: string,
+  port: number,
+): string | { error: string } {
+  const want = name.trim().toLowerCase().replace(/\.$/, "");
+  let routes: { host: string; url: string }[] = [];
+  try {
+    routes = webRouteHosts(readEdgeConfig(), new Set([port, readWebPort()]));
+  } catch {
+    routes = [];
+  }
+  const hit = routes.find((r) => r.host === want);
+  if (hit) return hit.url;
+  const known = routes.map((r) => r.host);
+  return {
+    error:
+      `--host ${name} is not a hostname this server answers to` +
+      (known.length
+        ? ` (its edge hostnames: ${known.join(", ")}).\n`
+        : " (no edge route reaches this server).\n") +
+      "  Add it to the config's edge block: its domain to edge.aliases (a VPN\n" +
+      "  name), or a route to this server in edge.routes, then `edge up`. For a\n" +
+      "  LAN name (DEN_BIND_HOST and web.allow_plain_http_remote) pass\n" +
+      "  --origin http://<name>:<port> instead.\n",
+  };
+}
+
 interface SessionRow {
   id: string;
   createdAt: string;

package/src/ui/server/agent-routes.ts

@@ -1,7 +1,9 @@
 /**
  * The Workspaces page's Agents section (AG-4a, AG spec §5c), its routes:
  *
- *   GET  /api/personas                            personas and runtimes
+ *   GET  /api/personas                            personas and runtimes (each
+ *                                                 with its path, where it came
+ *                                                 from and its version: AG-0.2)
  *   GET  /api/workspaces/<ws>/agents              the workspace's agents
  *   POST /api/workspaces/<ws>/agents              start { persona, runtime?, model?, id? }
  *   POST /api/workspaces/<ws>/agents/<id>/stop
@@ -18,7 +20,8 @@
  *   - a person only: an agent (its actor token, SEC-1c) can't start or
  *     stop agents from the page (403; agents use MCP agent_spawn, §5,
  *     under its own guards);
- *   - agents.max_concurrent (the host's cap: 429 cap).
+ *   - agents.max_concurrent (the host's cap on agents, never plain
+ *     sessions: 429 cap).
  * The env is the CLI's (§5a-env): the allowlist and the runtime's, built
  * from this server's environment, never all of it. Every action, refused
  * or done, is audited (recordAction) with the person as its actor.
@@ -203,7 +206,12 @@ export async function handleAgentRoutes(
   if (!m) {
     if (method !== "GET") return methodNotAllowed(res, "GET");
     try {
-      sendJson(res, { personas: listPersonas(d), runtimes: listRuntimes(d) });
+      sendJson(res, {
+        personas: listPersonas(d),
+        runtimes: await listRuntimes(d),
+        // AG-0.2: the file a person edits to set a runtime's path.
+        userConfig: d.userConfigFile(),
+      });
     } catch (e) {
       sendError(res, e);
     }

package/src/ui/server/edge-exposure.ts

@@ -0,0 +1,143 @@
+/**
+ * The edge counts as local (0.4.3): with no sign-in through the edge, who
+ * can reach the edge can use terminals. When Den can tell the edge is
+ * reachable beyond this machine it says so, once in web.log and in a
+ * banner on every page (the shell, dismissible per browser).
+ *
+ * How it tells (read-only, once at start):
+ *  - an edge hostname that routes to Den resolves to an address that isn't
+ *    loopback (a LAN or a VPN address, such as Tailscale's 100.x); or
+ *  - the edge's container publishes a port on every interface (a
+ *    PortBindings HostIp of "", 0.0.0.0 or ::), from `docker inspect`.
+ * Neither (an edge on `*.localhost`, published on 127.0.0.1, or not
+ * running): no warning.
+ */
+import { execFile } from "child_process";
+import { promises as dns } from "dns";
+import { isLoopbackAddress } from "./request-guard.js";
+
+export const EDGE_EXPOSED_MESSAGE =
+  "Your edge is reachable from other machines; anyone who can reach it can use terminals. Auth is coming.";
+
+export interface ExposureDeps {
+  /** Every address a hostname resolves to (none when it doesn't). */
+  lookup?: (host: string) => Promise<string[]>;
+  /** The edge container's `docker inspect` PortBindings, or null. */
+  portBindings?: (container: string) => Promise<unknown>;
+}
+
+async function lookupAll(host: string): Promise<string[]> {
+  try {
+    return (await dns.lookup(host, { all: true })).map((a) => a.address);
+  } catch {
+    return [];
+  }
+}
+
+function inspectPortBindings(container: string): Promise<unknown> {
+  return new Promise((resolve) => {
+    execFile(
+      "docker",
+      ["inspect", "--format", "{{json .HostConfig.PortBindings}}", container],
+      { timeout: 5000 },
+      (err, stdout) => {
+        if (err) return resolve(null);
+        try {
+          resolve(JSON.parse(String(stdout)));
+        } catch {
+          resolve(null);
+        }
+      },
+    );
+  });
+}
+
+/** A published port bound on every interface, from PortBindings. */
+export function publishedOnAllInterfaces(bindings: unknown): string | null {
+  if (!bindings || typeof bindings !== "object") return null;
+  for (const [port, list] of Object.entries(bindings as object)) {
+    if (!Array.isArray(list)) continue;
+    for (const b of list as { HostIp?: string; HostPort?: string }[]) {
+      const ip = String(b?.HostIp ?? "");
+      if (ip === "" || ip === "0.0.0.0" || ip === "::")
+        return `the edge publishes ${b?.HostPort || port} on every interface`;
+    }
+  }
+  return null;
+}
+
+/**
+ * Why the edge is reachable beyond this machine, or null when Den can't
+ * tell that it is.
+ */
+export async function edgeExposure(
+  hosts: readonly string[],
+  container: string | null,
+  deps: ExposureDeps = {},
+): Promise<string | null> {
+  const lookup = deps.lookup ?? lookupAll;
+  for (const h of hosts) {
+    const away = (await lookup(h)).find((a) => !isLoopbackAddress(a));
+    if (away) return `${h} resolves to ${away}`;
+  }
+  if (!container || hosts.length === 0) return null;
+  const bindings = await (deps.portBindings ?? inspectPortBindings)(container);
+  return publishedOnAllInterfaces(bindings);
+}
+
+/**
+ * The IPv4 subnets of the edge's Docker networks (`<org>-edge` and the
+ * external networks it joins), from `docker network inspect`, read-only,
+ * once at start. On OrbStack and Docker Desktop a user-defined network is
+ * no host interface, so localNet can't see it: a proxy container on it, or
+ * its gateway, is this machine's container network ("can't tell", so
+ * local), not another machine. None when Docker or the network isn't
+ * there.
+ */
+export async function edgeNetworkSubnets(
+  names: readonly string[],
+  inspect: (name: string) => Promise<unknown> = inspectNetworkIpam,
+): Promise<{ address: string; netmask: string }[]> {
+  const out: { address: string; netmask: string }[] = [];
+  for (const n of [...new Set(names)]) {
+    const ipam = await inspect(n);
+    if (!Array.isArray(ipam)) continue;
+    for (const c of ipam as { Subnet?: unknown }[]) {
+      const s = cidrToSubnet(String(c?.Subnet ?? ""));
+      if (s) out.push(s);
+    }
+  }
+  return out;
+}
+
+/** "192.168.214.0/24" → { address, netmask }; null for IPv6 or junk. */
+export function cidrToSubnet(
+  cidr: string,
+): { address: string; netmask: string } | null {
+  const m = /^(\d{1,3}(?:\.\d{1,3}){3})\/(\d{1,2})$/.exec(cidr.trim());
+  if (!m) return null;
+  const bits = Number(m[2]);
+  if (bits < 8 || bits > 32) return null;
+  if (m[1].split(".").some((o) => Number(o) > 255)) return null;
+  const mask = (0xffffffff << (32 - bits)) >>> 0;
+  const netmask = [24, 16, 8, 0].map((s) => (mask >>> s) & 255).join(".");
+  return { address: m[1], netmask };
+}
+
+function inspectNetworkIpam(name: string): Promise<unknown> {
+  return new Promise((resolve) => {
+    execFile(
+      "docker",
+      ["network", "inspect", "--format", "{{json .IPAM.Config}}", name],
+      { timeout: 5000 },
+      (err, stdout) => {
+        if (err) return resolve(null);
+        try {
+          resolve(JSON.parse(String(stdout)));
+        } catch {
+          resolve(null);
+        }
+      },
+    );
+  });
+}

package/src/ui/server/index.ts

@@ -184,8 +184,10 @@ import {
   bindRefusal,
   checkRequest,
   isEdgePeer,
+  isDockerBridgeAddress,
   isLoopbackAddress,
   isLoopbackBind,
+  localNet,
   newCsrfToken,
   principalOf,
   requestIsHttps,
@@ -549,6 +551,13 @@ setHtmlFill((html) => {
         () => '<div id="den-shell" data-config-invalid="1"',
       );
   }
+  // 0.4.3: every page says when the edge is reachable from other machines.
+  if (EDGE_EXPOSED)
+    out = out.replace(
+      '<div id="den-shell"',
+      () =>
+        `<div id="den-shell" data-edge-exposed="${escAttr(EDGE_EXPOSED_MESSAGE)}"`,
+    );
   // MD-2: every page says when the engine on disk is not the one running.
   const engine = engineCheck();
   if (engine.stale)
@@ -773,7 +782,17 @@ import {
 import { refuseUpgrade } from "./websocket.js";
 import { isLifecycleExecCmd, streamLifecycleExec } from "./lifecycle-exec.js";
 import { readEdgeConfig, readWebPort } from "../../shared/edge/config.js";
-import { edgeDomains, edgeHttps, routeHost } from "../../shared/edge/render.js";
+import {
+  edgeHttps,
+  edgeNames,
+  webRouteHosts,
+} from "../../shared/edge/render.js";
+import {
+  EDGE_EXPOSED_MESSAGE,
+  edgeExposure,
+  edgeNetworkSubnets,
+} from "./edge-exposure.js";
+import { initLoginPath } from "../../shared/agents/runtime-search.js";
 import {
   linksFor,
   openUrlFor,
@@ -904,24 +923,8 @@ function denEdgeHosts(): string[] {
   } catch {
     return [];
   }
-  const ports = new Set([PORT, readWebPortSafe()]);
-  const names = Object.entries(cfg.routes)
-    .filter(([, upstream]) => {
-      try {
-        const u = new URL(upstream);
-        return (
-          ports.has(Number(u.port || (u.protocol === "https:" ? 443 : 80))) &&
-          ["host.docker.internal", "localhost", "127.0.0.1"].includes(
-            u.hostname,
-          )
-        );
-      } catch {
-        return false;
-      }
-    })
-    .map(([name]) => name);
-  return names.flatMap((n) =>
-    edgeDomains(cfg).map((d) => routeHost(n, d).toLowerCase()),
+  return webRouteHosts(cfg, new Set([PORT, readWebPortSafe()])).map(
+    (r) => r.host,
   );
 }
 
@@ -1016,6 +1019,36 @@ function sessionCookie(req: http.IncomingMessage): string | undefined {
 }
 
 const LAN_HOSTS = lanHosts();
+/** This machine's addresses (localNet), re-read at most every 10 s. */
+let LOCAL_NET = { at: 0, net: localNet() };
+/** The edge's Docker networks' subnets (edgeNetworkSubnets), once at start. */
+let EDGE_NETS: { address: string; netmask: string }[] = [];
+function currentLocalNet(): ReturnType<typeof localNet> {
+  if (Date.now() - LOCAL_NET.at > 10_000) {
+    const here = localNet();
+    LOCAL_NET = {
+      at: Date.now(),
+      net: { own: here.own, bridges: [...here.bridges, ...EDGE_NETS] },
+    };
+  }
+  return LOCAL_NET.net;
+}
+/** Read the edge's Docker networks' subnets in the background (no edge: none). */
+function readEdgeNetworks(): void {
+  let names: string[];
+  try {
+    const cfg = readEdgeConfig();
+    names = [edgeNames(cfg.org).network, ...cfg.networks];
+  } catch {
+    return;
+  }
+  void edgeNetworkSubnets(names)
+    .then((nets) => {
+      EDGE_NETS = nets;
+      LOCAL_NET = { at: 0, net: LOCAL_NET.net }; // re-read on the next request
+    })
+    .catch(() => undefined);
+}
 const GUARD: GuardContext = {
   port: PORT,
   loopbackNames: loopbackNames(),
@@ -1044,8 +1077,43 @@ const GUARD: GuardContext = {
   peerIsLoopback: (req) => isLoopbackAddress(req.socket?.remoteAddress),
   // The edge hostname only from the edge's own peers (loopback, Docker).
   peerIsEdge: (req) => isEdgePeer(req.socket?.remoteAddress),
+  // 0.4.3: the edge from this machine counts as local (edgeClientIsLocal).
+  localNet: currentLocalNet,
+  // A deliberate exposure (DEN_BIND_HOST beyond loopback, other than the
+  // Linux edge's Docker bridge): the edge needs a sign-in too.
+  exposed: !isLoopbackBind(BIND_HOST) && !isDockerBridgeAddress(BIND_HOST),
 };
 
+/**
+ * 0.4.3: why the edge is reachable beyond this machine (edge-exposure.ts),
+ * once at start; null until known, or when Den can't tell.
+ */
+let EDGE_EXPOSED: string | null = null;
+function checkEdgeExposure(): void {
+  // `docker inspect` only when the edge publishes host ports itself
+  // (edge.publish); behind another proxy, only the hostnames tell.
+  let container: string | null = null;
+  try {
+    const cfg = readEdgeConfig();
+    container = cfg.ports ? edgeNames(cfg.org).container : null;
+  } catch {
+    return; // no edge
+  }
+  const hosts = denEdgeHosts();
+  if (hosts.length === 0) return;
+  void edgeExposure(hosts, container)
+    .then((why) => {
+      if (!why) return;
+      EDGE_EXPOSED = why;
+      // The in-app log, and stderr, which is web.log even when `web up`
+      // starts this --silent (stdout is not written then).
+      const line = `  ⚠ ${EDGE_EXPOSED_MESSAGE} (${why})`;
+      pushLog("warn", line);
+      if (!outputLost()) process.stderr.write(line + "\n");
+    })
+    .catch(() => undefined);
+}
+
 /**
  * The Set-Cookie for a session: HttpOnly, SameSite=Strict, Path=/, Secure
  * when the request came over HTTPS (requestIsHttps: the edge's own header
@@ -4543,6 +4611,17 @@ try {
   serverLog(`  ⚠ cache warm-up failed: ${(e as Error).message}`);
 }
 
+// Ignored config keys (a distribution's web.allow_plain_http_remote, the
+// old web.session lifetimes): the in-app log, and stderr, which is web.log
+// even when `web up` starts this --silent. Before the bind refusal, which
+// such a key often explains.
+{
+  const ignored = ignoredConfigWarning(WEB_AUTH);
+  if (ignored) {
+    pushLog("warn", `  ⚠ ${ignored}`);
+    if (!outputLost()) process.stderr.write(`  ⚠ ${ignored}\n`);
+  }
+}
 // §4: a non-loopback bind needs HTTPS in front, or the person's say-so.
 {
   const refusal = bindRefusal(BIND_HOST, {
@@ -4554,10 +4633,6 @@ try {
     process.exit(1);
   }
 }
-{
-  const ignored = ignoredConfigWarning(WEB_AUTH);
-  if (ignored) serverLog(`  ⚠ ${ignored}`, "warn");
-}
 // SEC-1a: the secret the CLI's person token is derived from (0600 in the
 // state dir). Never printed or logged; a failure leaves bearers unverifiable.
 try {
@@ -4565,6 +4640,11 @@ try {
 } catch (e) {
   serverLog(`  ⚠ web.secret could not be created: ${(e as Error).message}`);
 }
+// AG-0.1: the login shell's PATH, once, in the background (3 s at most),
+// so agents find their CLI as the person's terminal would: a launchd
+// service's PATH leaves out ~/.local/bin. Until (or unless) it answers, the
+// search is this PATH and the runtimes' install directories.
+void initLoginPath();
 server.listen(PORT, BIND_HOST, () => {
   const hosts = fs.existsSync("/etc/hosts")
     ? fs.readFileSync("/etc/hosts", "utf-8")
@@ -4587,6 +4667,8 @@ server.listen(PORT, BIND_HOST, () => {
   console.log();
   // Once per start: a secrets config that leaves Den's own features off.
   for (const w of secretsConfigWarnings()) serverLog(`  ⚠ ${w}`);
+  checkEdgeExposure();
+  readEdgeNetworks();
 });
 
 // ── Graceful shutdown ─────────────────────────────────────────────────────────